Secure vehicle network architecture

Abstract

Embodiments of the disclosure can provide for secure communication in a vehicle network by distinguishing among communications at different layers of the vehicle network and using different security levels depending on the network layer. For example, a communication between different electronic control units (ECUs) in the same domain (e.g., two ECUs in the powertrain domain) may not need as much as security as a communication that originates from an ECU in a different domain (e.g., the chassis domain) or from a device outside the vehicle. This can allow for increased security where compromise is a greater possibility, such as when communications originate from outside the vehicle, and decreased security where comprise is a lesser possibility and performance is a greater concern, such as communications between ECUs within the vehicle and/or in the same domain.

What is claimed is: 
     
         1 . A vehicle comprising:
 a center hub; and   a plurality of electronic control units connected to the center hub;   wherein the plurality of electronic control units are configured such that a first set of controller area network (CAN) messages are communicated at a first security level between the center hub and the plurality of electronic control units, and a second set of CAN messages are communicated at a second security level, lower than the first security level, among the plurality of electronic control units.   
     
     
         2 . The vehicle of  claim 1 , wherein communicating the first set of CAN messages at the first security level includes authenticating a source of each respective CAN message of the first set of CAN messages, and communicating the second set of CAN messages at the second security level does not include authenticating a source of each respective CAN message of the second set of CAN messages. 
     
     
         3 . The vehicle of  claim 2 , wherein authenticating the source of each respective CAN message of the first set of CAN messages includes authenticating a media access control (MAC) address of the source. 
     
     
         4 . The vehicle of  claim 1 , wherein communicating the first set of CAN messages at the first security level includes comparing a message type of each respective CAN message of the first set of CAN messages to a list of allowed message types, and communicating the second set of CAN messages at the second security level does not include comparing a message type of each respective CAN message of the second set of CAN messages to the list of allowed message types. 
     
     
         5 . The vehicle of  claim 1 , wherein the center hub is configured such that a third set of CAN messages are communicated at a third security level, higher than the first security level, between the center hub and one or more remote devices connected to the center hub across a network. 
     
     
         6 . The vehicle of  claim 5 , wherein communicating the third set of CAN messages at the third security level includes encrypting the third set of CAN messages, and communicating the first set of CAN messages at the first security level does not include encrypting the first set of CAN messages. 
     
     
         7 . The vehicle of  claim 1 , wherein the vehicle further comprises:
 a plurality of domains, each comprising a CAN bus and a domain controller that interfaces between the CAN bus and the center hub.   
     
     
         8 . The vehicle of  claim 7 , wherein each domain controller interfaces with the center hub via Eithernet. 
     
     
         9 . The vehicle of  claim 7 , wherein the plurality of electronic control units all belong to a first domain of the plurality of domains, and the plurality of electronic control units are connected to each other via a respective CAN bus of the first domain. 
     
     
         10 . A method of communicating between a center hub and a plurality of electronic control units in a vehicle, the method comprising:
 communicating a controller area network (CAN) message from a source to a first electronic control unit of the plurality of electronic control units;   wherein:
 in accordance with the source of the CAN message not being one of the plurality of electronic control units, the CAN message is communicated to the first electronic control unit at a first security level; and 
 in accordance with the source of the CAN message being one of the plurality of electronic control units, the CAN message is communicated to the first electronic control unit at a second security level, lower than the first security level. 
   
     
     
         11 . The method of  claim 10 , wherein, in accordance with the source of the CAN message being outside the vehicle, the CAN message is communicated to the first electronic control unit at a third security level, higher than the first security level. 
     
     
         12 . The method of  claim 10 , wherein:
 the plurality of electronic control units belong to a first domain and an additional plurality of electronic control units belong to a second domain, different from the first domain;   the CAN message is communicated to the first electronic control unit at the first security level further in accordance with the source of the CAN message being one of the additional plurality of electronic control units belonging to the second domain; and   the CAN message is communicated to the first electronic control unit at the second security level further in accordance with the source of the CAN message being one of the plurality of electronic control units belonging to the first domain.   
     
     
         13 . A non-transitory computer readable storage medium storing instructions that, when executed by one or more processors, cause the processors to perform a method of communicating between a center hub and a plurality of electronic control units in a vehicle, the method comprising:
 communicating a controller area network (CAN) message from a source to a first electronic control unit of the plurality of electronic control units;   wherein:
 in accordance with the source of the CAN message not being one of the plurality of electronic control units, the CAN message is communicated to the first electronic control unit at a first security level; and 
 in accordance with the source of the CAN message being one of the plurality of electronic control units, the CAN message is communicated to the first electronic control unit at a second security level, lower than the first security level. 
   
     
     
         14 . A non-transitory computer readable storage medium storing instructions that, when executed by one or more processors, cause the processors to perform a method of communicating between a center hub and a plurality of electronic control units in a vehicle, the method comprising:
 receiving a controller area network (CAN) message at the center hub for delivery to a first electronic control unit of the plurality of electronic control units;   identifying a message type of the CAN message;   in accordance with the message type of the CAN message belonging to a list of allowed message types, delivering the CAN message to the first electronic control unit; and   in accordance with the message type of the CAN message not belonging to the list of allowed messages types, dropping the CAN message without delivering to the first electronic control unit.   
     
     
         15 . A system comprising:
 one or more processors; and   a memory;   wherein the one or more processors are configures to perform a method of communicating between a center hub and a plurality of electronic control units in a vehicle, the method comprising:   communicating a controller area network (CAN) message from a source to a first electronic control unit of the plurality of electronic control units;   wherein:
 in accordance with the source of the CAN message not being one of the plurality of electronic control units, the CAN message is communicated to the first electronic control unit at a first security level; and 
 in accordance with the source of the CAN message being one of the plurality of electronic control units, the CAN message is communicated to the first electronic control unit at a second security level, lower than the first security level. 
   
     
     
         16 . A system comprising:
 one or more processors; and   a memory;   wherein the one or more processors are configured to perform a method of communicating between a center hub and a plurality of electronic control units in a vehicle, the method comprising:   receiving a controller area network (CAN) message at the center hub for delivery to a first electronic control unit of the plurality of electronic control units;   identifying a message type of the CAN message;   in accordance with the message type of the CAN message belonging to a list of allowed message types, delivering the CAN message to the first electronic control unit; and   in accordance with the message type of the CAN message not belonging to the list of allowed messages types, dropping the CAN message without delivering to the first electronic control unit.